verificacao[.]7gamesbr[.]link

This domain, verificacao.7gamesbr.link, operates as a credential harvesting phishing site designed to impersonate Facebook's login infrastructure. The site presents a fraudulent Instagram login page (title: 'Entrar ° Instagram') to trick users into submitting their account credentials, which are then captured by threat actors for unauthorized account access, financial fraud, or further phishing campaigns. The domain specifically targets Portuguese-speaking users, as indicated by the page title and domain structure, increasing the risk for users in Brazil and other Lusophone regions. Analysis indicates this domain was registered on November 15, 2025, through Tucows Domains Inc., an unusually recent creation date for a phishing site, suggesting it was set up specifically for malicious purposes. The domain lacks an SSL certificate, a common red flag for fraudulent sites, and resolves to the IP address 84.201.5.93, hosted on AS214036 (Ultahost, Inc.) in Germany. Security vendors have flagged this domain at a rate of 20/95 on VirusTotal, and it appears on two security blocklists, including PhishDestroy and PhishingDB. The absence of encryption, combined with the domain's rapid detection by multiple security engines, underscores its malicious intent. Users who visited verificacao.7gamesbr.link or entered credentials on the site should immediately take corrective action. First, change the password for the affected Facebook/Instagram account and enable multi-factor authentication if not already active. Second, review the account for unauthorized activity, including posts, messages, or linked applications, and revoke access to any suspicious third-party apps. Third, scan the device used to access the site for malware, as phishing pages may deploy additional payloads. Finally, monitor financial accounts and credit reports for signs of identity theft, as stolen credentials can be leveraged for broader fraud. If credentials were reused on other platforms, update those passwords immediately to prevent cross-account compromise.